CVE-2021-32036 Denial of Service and Data Integrity vulnerability in features command

2022-02-0400:00:00

CWE-770

mongodb

www.cve.org

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.8%

JSON

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MongoDB Server",
    "vendor": "MongoDB Inc.",
    "versions": [
      {
        "lessThanOrEqual": "5.0.3",
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.4.9",
        "status": "affected",
        "version": "4.4",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.2.16",
        "status": "affected",
        "version": "4.2",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.0.28",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      }
    ]
  }
]